Lithuanian prosecutors say Russia-linked network planned arson attacks in Europe

Lithuanian prosecutors said Wednesday they uncovered a Russia-linked network of suspects who allegedly planned and organized arson attacks across Europe. The prosecutor general’s office in Vilnius said the group, comprising 15 people from Russia, Lithuania, Latvia, Estonia and Ukraine, coordinated the sending of homemade incendiary devices to other European Union countries and the United Kingdom on behalf of the Russian secret service. The statement described the operation as an organized effort to carry out coordinated acts of arson, with the devices designed to cause fires at targeted sites. The investigation noted the existence of an international emphasis, including an arrest-warrant track for three individuals, while providing no immediate tally of arrests in any country. The authorities stressed that the inquiry is ongoing and that more details could be released as investigations proceed.

Two shipments were sent from Vilnius to Britain by DHL cargo planes, and the other two were sent to Poland by DPD trucks, according to the Vilnius prosecutor’s office. The packages contained highly flammable thermite and other incendiary components, concealed inside everyday items such as massage cushions and tubes of cosmetics. The timeline outlined by the authorities shows at least four packages connected to the alleged operation, with one of the shipments catching fire at a DHL logistics center in Leipzig while awaiting transfer to its final destination. Investigators say another package detonated on July 21 in a DPD truck traveling through Poland, and a third exploded on July 22 inside a DHL warehouse in Birmingham, England. A fourth package failed to detonate due to a technical defect, according to the statement.

The Lithuanian authorities did not provide a precise count of arrests in Lithuania or other countries, saying only that an international arrest warrant had been issued for three people. The statement underscored that the investigation involved more than 30 searches across Lithuania, Poland, Latvia and Estonia, during which additional incendiary devices were discovered. The evidence indicates the devices could have been used to plan and execute further attacks, and investigators said the devices included thermite, a substance with industrial and military applications known for its intense heat when ignited.

Officials said the operations appeared to be coordinated by Russian citizens with links to the Russian military intelligence service, the GRU. The probe’s findings point to a deliberate attempt to extend disruption across Europe, with real operations tied to shipments that originated in Vilnius and moved through multiple European logistics networks. The discovery aligns with prior assertions by European security officials that Russia has conducted sabotage and covert actions in retaliation for support shown to Ukraine. While the scope of the operation remains under investigation, prosecutors highlighted the transnational nature of the case as a key factor in the ongoing efforts to map out the network’s reach and deeper connections.

The case arrives at a time of heightened vigilance across Europe regarding potential Russian covert activity aimed at sowing chaos and undermining public safety. Authorities emphasized cross-border collaboration, rapid information sharing and the use of courier networks to reach multiple destinations within the European Union and beyond. The Lithuanian statement did not specify the targets that were intended for the arson attacks or whether any sites were identified as potential future targets. Nevertheless, the events described illustrate how a single network could leverage established logistics channels to execute a dangerous and audacious campaign against for which European authorities say Russia bears responsibility.

Law enforcement officials in Lithuania, Latvia, Estonia and Poland said they would continue working with counterparts in Britain and other EU states to determine whether additional devices or related materials remain in circulation, and to ensure that any remaining threats are neutralized. As investigators examine the full chronology of the shipments and the individuals involved, they have stressed that the case demonstrates the importance of ongoing, cooperative monitoring of cross-border threats connected to state-backed intelligence operations. The investigation remains open, and authorities said they expect to release further updates as more evidence comes to light.